Coverage for demo_server/api/blog/business.py: 85%

1# Copyright (c) Microsoft Corporation. 

2# Licensed under the MIT License. 

3 

4from demo_server.database.models import Post, Category, db 1 ctx1n

5from flask import abort 1 ctx1n

6from flask import request 1 ctx1n

7import json 1 ctx1n

8 

9def get_query(): 1 ctx1n

10 # Gets the query string from the request 

11 query = urllib.parse.urlparse(request.url).query 15 ctx1mkfajghibcdopel

12 if query: 12 ↛ 13line 12 didn't jump to line 13 because the condition on line 12 was never true15 ctx1mkfajghibcdopel

13 return urllib.parse.unquote(query) 

14 return None 15 ctx1mkfajghibcdopel

15 

16def check_double_query_bug(): 1 ctx1n

17 # Responds with '500' error if the query string is a '?' 

18 if get_query() == '?': 18 ↛ 19line 18 didn't jump to line 19 because the condition on line 18 was never true12 ctx1mkfaghibcdel

19 abort(500) 

20 

21def check_no_id_bug(): 1 ctx1n

22 # Responds with '500' error if 'id' is missing from the body 

23 if request.json.get('id') == None: 11 ctx1kfajghibcde

24 abort(500) 3 ctx1kfa

25 

26def check_unexpected_query_string(): 1 ctx1n

27 # Responds with '400' if a query string exists 

28 if get_query() is not None: 28 ↛ 29line 28 didn't jump to line 29 because the condition on line 28 was never true14 ctx1mfajghibcdopel

29 abort(400) 

30 

31def get_post(postId): 1 ctx1n

32 # PLANTED_BUG to be detected by invalid dynamic object checker 

33 check_double_query_bug() 12 ctx1mkfaghibcdel

34 # PLANTED_BUG - 

35 # Intentionally ignore unexpected query, so the invalid dynamic 

36 # object checker throws a bug due to '200' response. 

37 

38 post = Post.query.filter(Post.id == postId).one_or_none() 12 ctx1mkfaghibcdel

39 return post or abort(404) 12 ctx1mkfaghibcdel

40 

41def create_blog_post(): 1 ctx1n

42 body = request.json.get('body') 14 ctx1mkfajqghibcdel

43 post = Post(body) 14 ctx1mkfajqghibcdel

44 db.session.add(post) 14 ctx1mkfajqghibcdel

45 db.session.commit() 14 ctx1mkfajqghibcdel

46 return post 14 ctx1mkfajqghibcdel

47 

48import urllib 1 ctx1n

49def update_post(post_id): 1 ctx1n

50 # PLANTED_BUG to be detected by payload body checker 

51 check_no_id_bug() 11 ctx1kfajghibcde

52 

53 post = Post.query.filter(Post.id == post_id).one_or_none() 11 ctx1kfajghibcde

54 if not post: 11 ctx1kfajghibcde

55 abort(404) 4 ctx1bcde

56 checksum = request.json.get('checksum', '') 11 ctx1kfajghibcde

57 if post.checksum == checksum: 57 ↛ 58line 57 didn't jump to line 58 because the condition on line 57 was never true11 ctx1kfajghibcde

58 post.body = request.json.get('body') 

59 raise Exception 

60 db.session.add(post) 11 ctx1kfajghibcde

61 db.session.commit() 11 ctx1kfajghibcde

62 

63 

64def delete_post(post_id): 1 ctx1n

65 # Throw 400 if query string exists, to avoid triggering an 

66 # invalid dynamic object checker bug. 

67 check_unexpected_query_string() 14 ctx1mfajghibcdopel

68 

69 post = Post.query.filter(Post.id == post_id).one_or_none() 14 ctx1mfajghibcdopel

70 if post: 14 ctx1mfajghibcdopel

71 db.session.delete(post) 13 ctx1fajghibcdopel

72 db.session.commit() 13 ctx1fajghibcdopel

73 else: 

74 abort(404) 9 ctx1maghbcdel